CVE-2026-15723: GitLab CE/EE improper authentication in OmniAuth-to-LDAP auto-linking email lookup allows account takeover

When a user signs in through an OmniAuth provider such as SAML, GitLab can automatically link that identity to an existing LDAP account by looking up the account's email address in LDAP. GitLab says the input used in that LDAP email lookup was not properly sanitized. An attacker who controls the email value presented during the SAML sign-in can make the lookup match a different LDAP user, and GitLab then links the attacker's identity to that user's account.

The attacker needs a valid account and the ability to complete a SAML sign-in, which is why the CVSS vector lists low privileges and high complexity. There is no user interaction, and the scope change reflects that the attacker ends up acting as someone else, potentially an administrator or a maintainer of sensitive projects. In practice that means access to the victim's repositories, CI/CD settings, tokens and group permissions.

Self-managed GitLab CE/EE from 10.1 before 19.3.6, 19.4 before 19.4.3 and 19.5 before 19.5.1, and only where SAML OmniAuth and LDAP auto-linking are both turned on. Check gitlab.rb for omniauth_auto_link_ldap_user set to true together with a SAML provider in omniauth_providers, and check the version:

sudo grep -nE 'omniauth_auto_link_ldap_user|omniauth_providers' /etc/gitlab/gitlab.rb
sudo gitlab-rake gitlab:env:info | grep -A2 'GitLab information'

Upgrade to 19.5.1, 19.4.3 or 19.3.6. Lines 19.2 and older received only the critical regex fix in this release, so move to a supported line that includes this one.

If you cannot upgrade at once, turning off LDAP auto-linking for OmniAuth sign-ins (omniauth_auto_link_ldap_user set to false, then gitlab-ctl reconfigure) removes the vulnerable path, at the cost of users linking identities manually.

Review audit events for identity links: new SAML identities attached to existing LDAP users, especially administrators, and sign-ins where the SAML email does not match the account's LDAP email. Unexpected admin sessions, new personal access tokens or SSH keys on privileged accounts after a SAML sign-in are strong signals. Reset sessions and tokens for any account that shows an unexplained link.

When OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking. Impacted versions: GitLab CE/EE all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Fixed in GitLab CE/EE 19.5.1, 19.4.3 and 19.3.6, released October 21, 2026.